Privacy-Enhancing Technologies (PETs) are often presented as tools that enable the free flow of data while protecting personal information. In practice, however, PETs often fall short on their promise of safeguarding privacy without limiting data use. When privacy is reduced to a narrow conception of confidentiality, the tools marketed to enhance privacy risk undermining protection and entrenching existing concentrations of power. Drawing on two high-profile attempts at real-world deployment that were ultimately discontinued, this report shows how current approaches to PETs can obscure important risks, and that PETs must be understood as one component of a wider, rights-based governance framework rather than a technical fix for privacy problems. Crucially, broad engagement with diverse interdisciplinary stakeholders is an essential part of the process. In a time of legislative flux, where ‘simplification’ in pursuit of innovation is prominent in policy discussions, the limitations of PETs as a catch-all ‘solution’ must be accurately understood. This is especially the case as ongoing debates on the very ‘notion of personal data’, as reflected in the EU Digital Omnibus proposals, have the potential to further emphasise technical protections based on concepts of identifiability at the expense of full consideration of privacy harms.